This reverts commit 962400e, which was entirely bogus. The code used to multiply the character offset by "vc->vc_cols", and that's actually correct, because 'd' itself is an 'unsigned short'. So the pointer arithmetic already takes the size of a VGA character into account. Changing it to use vc_size_row (which is just "vc_cols" shifted up to take the size of the character into account) ends up multiplying with the VGA character size twice. This got reported as bugs for various other subsystems, because what it actually results in is writing the 16-bit vc_video_erase_char pattern (usually 0x0720: 0x07 is the default attribute, 0x20 is ASCII space) into some random other allocation. So Markus ended up reporting this as a ext4 bug, while to Torsten Kaiser it looked like a problem with KMS or libata. Jeff Chua saw it in different places. And finally - Justin Mattock had slab poisoning enabled, and saw it as a slab poison overwritten. And bisected and reverted this to verify the buggy commit. Reported-by: Markus Trippelsdorf <email@example.com> Reported-by: Torsten Kaiser <firstname.lastname@example.org> Reported-by: Jeff Chua <email@example.com> Reported-by: Justin P. Mattock <firstname.lastname@example.org> Reported-bisected-and-tested-by: Justin P. Mattock <email@example.com> Acked-by: Dave Airlie <firstname.lastname@example.org> Cc: Frank Pan <email@example.com> Cc: Greg Kroah-Hartman <firstname.lastname@example.org> Signed-off-by: Linus Torvalds <email@example.com>
Cursors need to be in the GTT domain when being accessed by the GPU. Previously this was a fortuitous byproduct of userspace using pwrite() to upload the image data into the cursor. The redundant clflush was removed in commit 9b8c4a and so the image was no longer being flushed out of the caches into main memory. One could also devise a scenario where the cursor was rendered by the GPU, prior to being attached as the cursor, resulting in similar corruption due to the missing MI_FLUSH. Fixes: Bug 28335 - Cursor corruption caused by commit 9b8c4a0 https://bugs.freedesktop.org/show_bug.cgi?id=28335 Signed-off-by: Chris Wilson <firstname.lastname@example.org> Reported-and-tested-by: Jeff Chua <email@example.com> Tested-by: Linus Torvalds <firstname.lastname@example.org> Reported-by: Andy Isaacson <email@example.com> Signed-off-by: Linus Torvalds <firstname.lastname@example.org>
…/git/tytso/ext4 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: Fix remaining racy updates of EXT4_I(inode)->i_flags ext4: Make sure the MOVE_EXT ioctl can't overwrite append-only files
A few functions were still modifying i_flags in a racy manner. Signed-off-by: Dmitry Monakhov <email@example.com> Signed-off-by: "Theodore Ts'o" <firstname.lastname@example.org>
* 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: improve xfs_isilocked xfs: skip writeback from reclaim context xfs: remove done roadmap item from xfs-delayed-logging-design.txt xfs: fix race in inode cluster freeing failing to stale inodes xfs: fix access to upper inodes without inode64 xfs: fix might_sleep() warning when initialising per-ag tree fs/xfs/quota: Add missing mutex_unlock xfs: remove duplicated #include xfs: convert more trace events to DEFINE_EVENT xfs: xfs_trace.c: remove duplicated #include xfs: Check new inode size is OK before preallocating xfs: clean up xlog_align xfs: cleanup log reservation calculactions xfs: be more explicit if RT mount fails due to config xfs: replace E2BIG with EFBIG where appropriate
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (30 commits) X25: remove duplicated #include tcp: use correct net ns in cookie_v4_check() rps: tcp: fix rps_sock_flow_table table updates ppp_generic: fix multilink fragment sizes syncookies: remove Kconfig text line about disabled-by-default ixgbe: only check pfc bits in hang logic if pfc is enabled net: check for refcount if pop a stacked dst_entry ixgbe: return IXGBE_ERR_RAR_INDEX when out of range act_pedit: access skb->data safely sfc: Store port number in net_device::dev_id epic100: Test __BIG_ENDIAN instead of (non-existent) CONFIG_BIG_ENDIAN tehuti: return -EFAULT on copy_to_user errors isdn/kcapi: return -EFAULT on copy_from_user errors e1000e: change logical negate to bitwise sfc: Get port number from CS_PORT_NUM, not PCI function number cls_u32: use skb_header_pointer() to dereference data safely TCP: tcp_hybla: Fix integer overflow in slow start increment act_nat: fix the wrong checksum when addr isn't in old_addr/mask net/fec: fix pm to survive to suspend/resume korina: count RX DMA OVR as rx_fifo_error ...
…/git/ryusuke/nilfs2 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2: nilfs2: remove obsolete declarations of cache constructor and destructor nilfs2: fix style issue in nilfs_destroy_cachep
…/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: Minix: Clean up left over label fix truncate inode time modification breakage fix setattr error handling in sysfs, configfs fcntl: return -EFAULT if copy_to_user fails wrong type for 'magic' argument in simple_fill_super() fix the deadlock in qib_fs mqueue doesn't need make_bad_inode()
…or-linus * git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: module: fix bne2 "gave up waiting for init of module libcrc32c" module: verify_export_symbols under the lock module: move find_module check to end module: make locking more fine-grained. module: Make module sysfs functions private. module: move sysfs exposure to end of load_module module: fix kdb's illicit use of struct module_use. module: Make the 'usage' lists be two-way
Problem: it's hard to avoid an init routine stumbling over a request_module these days. And it's not clear it's always a bad idea: for example, a module like kvm with dynamic dependencies on kvm-intel or kvm-amd would be neater if it could simply request_module the right one. In this particular case, it's libcrc32c: libcrc32c_mod_init crypto_alloc_shash crypto_alloc_tfm crypto_find_alg crypto_alg_mod_lookup crypto_larval_lookup request_module If another module is waiting inside resolve_symbol() for libcrc32c to finish initializing (ie. bne2 depends on libcrc32c) then it does so holding the module lock, and our request_module() can't make progress until that is released. Waiting inside resolve_symbol() without the lock isn't all that hard: we just need to pass the -EBUSY up the call chain so we can sleep where we don't hold the lock. Error reporting is a bit trickier: we need to copy the name of the unfinished module before releasing the lock. Other notes: 1) This also fixes a theoretical issue where a weak dependency would allow symbol version mismatches to be ignored. 2) We rename use_module to ref_module to make life easier for the only external user (the out-of-tree ksplice patches). Signed-off-by: Rusty Russell <email@example.com> Cc: Linus Torvalds <firstname.lastname@example.org> Cc: Tim Abbot <email@example.com> Tested-by: Brandon Philips <firstname.lastname@example.org>
It disabled preempt so it was "safe", but nothing stops another module slipping in before this module is added to the global list now we don't hold the lock the whole time. So we check this just after we check for duplicate modules, and just before we put the module in the global list. (find_symbol finds symbols in coming and going modules, too). Signed-off-by: Rusty Russell <email@example.com>
I think Rusty may have made the lock a bit _too_ finegrained there, and didn't add it to some places that needed it. It looks, for example, like PATCH 1/2 actually drops the lock in places where it's needed ("find_module()" is documented to need it, but now load_module() didn't hold it at all when it did the find_module()). Rather than adding a new "module_loading" list, I think we should be able to just use the existing "modules" list, and just fix up the locking a bit. In fact, maybe we could just move the "look up existing module" a bit later - optimistically assuming that the module doesn't exist, and then just undoing the work if it turns out that we were wrong, just before adding ourselves to the list. Signed-off-by: Rusty Russell <firstname.lastname@example.org>
Kay Sievers <email@example.com> reports that we still have some contention over module loading which is slowing boot. Linus also disliked a previous "drop lock and regrab" patch to fix the bne2 "gave up waiting for init of module libcrc32c" message. This is more ambitious: we only grab the lock where we need it. Signed-off-by: Rusty Russell <firstname.lastname@example.org> Cc: Brandon Philips <email@example.com> Cc: Kay Sievers <firstname.lastname@example.org> Cc: Linus Torvalds <email@example.com>
These were placed in the header in ef665c1 to get the various SYSFS/MODULE config combintations to compile. That may have been necessary then, but it's not now. These functions are all local to module.c. Signed-off-by: Rusty Russell <firstname.lastname@example.org> Cc: Randy Dunlap <email@example.com>
This means a little extra work, but is more logical: we don't put anything in sysfs until we're about to put the module into the global list an parse its parameters. This also gives us a logical place to put duplicate module detection in the next patch. Signed-off-by: Rusty Russell <firstname.lastname@example.org>
Linus changed the structure, and luckily this didn't compile any more. Reported-by: Stephen Rothwell <email@example.com> Signed-off-by: Rusty Russell <firstname.lastname@example.org> Cc: Jason Wessel <email@example.com> Cc: Martin Hicks <firstname.lastname@example.org>
When adding a module that depends on another one, we used to create a one-way list of "modules_which_use_me", so that module unloading could see who needs a module. It's actually quite simple to make that list go both ways: so that we not only can see "who uses me", but also see a list of modules that are "used by me". In fact, we always wanted that list in "module_unload_free()": when we unload a module, we want to also release all the other modules that are used by that module. But because we didn't have that list, we used to first iterate over all modules, and then iterate over each "used by me" list of that module. By making the list two-way, we simplify module_unload_free(), and it allows for some trivial fixes later too. Signed-off-by: Linus Torvalds <email@example.com> Signed-off-by: Rusty Russell <firstname.lastname@example.org> (cleaned & rebased)
I believe a moderate SYN flood attack can corrupt RFS flow table (rps_sock_flow_table), making RPS/RFS much less effective. Even in a normal situation, server handling short lived sessions suffer from bad steering for the first data packet of a session, if another SYN packet is received for another session. We do following action in tcp_v4_rcv() : sock_rps_save_rxhash(sk, skb->rxhash); We should _not_ do this if sk is a LISTEN socket, as about each packet received on a LISTEN socket has a different rxhash than previous one. -> RPS_NO_CPU markers are spread all over rps_sock_flow_table. Also, it makes sense to protect sk->rxhash field changes with socket lock (We currently can change it even if user thread owns the lock and might use rxhash) This patch moves sock_rps_save_rxhash() to a sock locked section, and only for non LISTEN sockets. Signed-off-by: Eric Dumazet <email@example.com> Signed-off-by: David S. Miller <firstname.lastname@example.org>
syncookies default to on since e994b7c (tcp: Don't make syn cookies initial setting depend on CONFIG_SYSCTL). Signed-off-by: Florian Westphal <email@example.com> Signed-off-by: David S. Miller <firstname.lastname@example.org>
Only check pfc bits in hang logic if PFC is enabled. Previously, if DCB was enabled but PFC was disabled the incorrect pause bits would be checked. Signed-off-by: John Fastabend <email@example.com> Acked-by: Don Skidmore <firstname.lastname@example.org> Signed-off-by: Jeff Kirsher <email@example.com> Signed-off-by: David S. Miller <firstname.lastname@example.org>
xfrm triggers a warning if dst_pop() drops a refcount on a noref dst. This patch changes dst_pop() to skb_dst_pop(). skb_dst_pop() drops the refcnt only on a refcounted dst. Also we don't clone the child dst_entry, so it is not refcounted and we can use skb_dst_set_noref() in xfrm_output_one(). Signed-off-by: Steffen Klassert <email@example.com> Signed-off-by: Eric Dumazet <firstname.lastname@example.org> Signed-off-by: David S. Miller <email@example.com>
…/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - add Cintiq 21UX2 and Intuos4 WL Input: ads7846 - fix compiler warning in ads7846_probe() Input: tps6507x-ts - a couple work queue cleanups Input: s3c2410_ts - tone down logging Input: s3c2410_ts - fix build error due to ADC Kconfig rename
* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (23 commits) sh: Make intc messages consistent via pr_fmt. sh: make sure static declaration on ms7724se sh: make sure static declaration on mach-migor sh: make sure static declaration on mach-ecovec24 sh: make sure static declaration on mach-ap325rxa clocksource: sh_cmt: compute mult and shift before registration clocksource: sh_tmu: compute mult and shift before registration sh: PIO disabling for x3proto and urquell. sh: mach-sdk7786: conditionally disable PIO support. sh: support for platforms without PIO. usb: r8a66597-hcd pio to mmio accessor conversion. usb: gadget: r8a66597-udc pio to mmio accessor conversion. usb: gadget: m66592-udc pio to mmio accessor conversion. sh: add romImage MMCIF boot for sh7724 and Ecovec V2 sh: add boot code to MMCIF driver header sh: prepare MMCIF driver header file sh: allow romImage data between head.S and the zero page sh: Add support MMCIF for ecovec sh: remove duplicated #include input: serio: disable i8042 for non-cayman sh platforms. ...
…l/git/mchehab/i7core * 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core: (83 commits) i7core_edac: Better describe the supported devices Add support for Westmere to i7core_edac driver i7core_edac: don't free on success i7core_edac: Add support for X5670 Always call i7core_[ur]dimm_check_mc_ecc_err i7core_edac: fix memory leak of i7core_dev EDAC: add __init to i7core_xeon_pci_fixup i7core_edac: Fix wrong device id for channel 1 devices i7core: add support for Lynnfield alternate address i7core_edac: Add initial support for Lynnfield i7core_edac: do not export static functions edac: fix i7core build edac: i7core_edac produces undefined behaviour on 32bit i7core_edac: Use a more generic approach for probing PCI devices i7core_edac: PCI device is called NONCORE, instead of NOCORE i7core_edac: Fix ringbuffer maxsize i7core_edac: First store, then increment i7core_edac: Better parse "any" addrmask i7core_edac: Use a lockless ringbuffer edac: Create an unique instance for each kobj ...
…ernel/git/mchehab/linux-2.6 * 'v4l_for_2.6.35' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (87 commits) V4L/DVB: ivtv: Timing tweaks and code re-order to try and improve stability V4L/DVB: ivtv: Avoid accidental video standard change V4L/DVB: ivtvfb : Module load / unload fixes V4L/DVB: cx2341x: Report correct temporal setting for log-status V4L/DVB: cx18, cx23885, v4l2 doc, MAINTAINERS: Update Andy Walls' email address V4L/DVB: drivers/media: Eliminate a NULL pointer dereference V4L/DVB: dvb-core: Fix ULE decapsulation bug V4L/DVB: Bug fix: make IR work again for dm1105 V4L/DVB: media/IR: nec-decoder needs to select BITREV V4L/DVB: video/saa7134: change dprintk() to i2cdprintk() V4L/DVB: video/saa7134: remove duplicate break V4L/DVB: IR/imon: add auto-config for 0xffdc rf device V4L/DVB: IR/imon: clean up usage of bools V4L/DVB: em28xx: remove unneeded null checks V4L/DVB: ngene: remove unused #include <linux/version.h> V4L/DVB: ak881x needs slab.h V4L/DVB: FusionHDTV: Use quick reads for I2C IR device probing V4L/DVB: Technotrend S2-3200 ships with a TT 1500 remote V4L/DVB: drivers/media: Use kzalloc V4L/DVB: m920x: Select simple tuner ...
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: (27 commits) block: make blk_init_free_list and elevator_init idempotent block: avoid unconditionally freeing previously allocated request_queue pipe: change /proc/sys/fs/pipe-max-pages to byte sized interface pipe: change the privilege required for growing a pipe beyond system max pipe: adjust minimum pipe size to 1 page block: disable preemption before using sched_clock() cciss: call BUG() earlier Preparing 8.3.8rc2 drbd: Reduce verbosity drbd: use drbd specific ratelimit instead of global printk_ratelimit drbd: fix hang on local read errors while disconnected drbd: Removed the now empty w_io_error() function drbd: removed duplicated #includes drbd: improve usage of MSG_MORE drbd: need to set socket bufsize early to take effect drbd: improve network latency, TCP_QUICKACK drbd: Revert "drbd: Create new current UUID as late as possible" brd: support discard Revert "writeback: fix WB_SYNC_NONE writeback from umount" Revert "writeback: ensure that WB_SYNC_NONE writeback with sb pinned is sync" ...
…git/mmarek/kbuild-2.6 * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6: gconfig: fix build failure on fedora 13
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: (27 commits) Staging: sep: return -EFAULT on copy_to_user errors Staging: rc2860: return -EFAULT on copy_to_user errors Staging: Eliminate a NULL pointer dereference staging: Use GFP_ATOMIC when a lock is held Staging: comedi - correct parameter gainlkup for DAQCard-6024E in driver ni_mio_cs.c Staging: comedi: fixing ni_labpc to mite dependancy Staging: wlags49_h2, wlags49_h25: fixed Kconfig dependencies Staging: phison: depends on ATA_BMDMA Staging: iio-utils: fix memory overflow for dynamically allocateded memory to hold filename Staging: adis16255: add proper section markings to hotplug funcs Staging: adis16255: fix typo in Kconfig Staging: batman-adv: Don't allocate icmp packet with GFP_KERNEL Staging: batman-adv: Don't call free_netdev twice Staging: batman-adv: Call unregister_netdev on failures to get rtnl lock Staging: batman-adv: fix rogue packets on shutdown Staging: add MSM framebuffer driver Staging: comedi: fixing ni_tio to mite PCI dependancy Staging: comedi: fix 8255 and DAS08 Kconfig dependancies. Staging: comedi: For COMEDI_BUFINFO, check access to command Staging: comedi: COMEDI_BUFINFO with no async - report no bytes read or written ...
…e-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: fix setattr error handling in sysfs, configfs kobject: free memory if netlink_kernel_create() fails lib/kobject_uevent.c: fix CONIG_NET=n warning
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: serial: add support for various Titan PCI cards vt_ioctl: return -EFAULT on copy_from_user errors serial: altera_uart: Proper section for altera_uart_remove tty: fix a little bug in scrup, vt.c altera_uart: Simplify altera_uart_console_putc altera_uart: Don't take spinlock in already protected functions TTY/n_gsm: potential double lock serial: bfin_5xx: fix typo in IER check serial: bfin_5xx: IRDA is not affected by anomaly 05000230 serial_cs: add and sort IDs for serial and modem cards msm_serial: fix serial on trout
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: unbind all interfaces before rebinding them USB: serial: digi_acceleport: Eliminate a NULL pointer dereference usb: fix ehci_hcd build failure when both generic-OF and xilinx is selected USB: cdc-acm: fix resource reclaim in error path of acm_probe USB: ftdi_sio: fix DTR/RTS line modes USB: s3c-hsotg: Ensure FIFOs are fully flushed after layout USB: s3c-hsotg: SoftDisconnect minimum 3ms USB: s3c-hsotg: Ensure TX FIFO addresses setup when initialising FIFOs USB: s3c_hsotg: define USB_GADGET_DUALSPEED in Kconfig USB: s3c: Enable soft disconnect during initialization USB: xhci: Print NEC firmware version. USB: xhci: Wait for host to start running. USB: xhci: Wait for controller to be ready after reset. USB: isp1362: fix inw warning on Blackfin systems USB: mos7840: fix null-pointer dereference